Medium severity · published Mar 18, 2026
CVE-2026-2575
Keycloak: keycloak: denial of service due to excessive samlrequest decompression
5.3
CVSS
0.6%
EPSS
No
On KEV
Description
A flaw was found in Keycloak. An unauthenticated remote attacker can trigger an application level Denial of Service (DoS) by sending a highly compressed SAMLRequest through the SAML Redirect Binding. The server fails to enforce size limits during DEFLATE decompression, leading to an OutOfMemoryError (OOM) and subsequent process termination. This vulnerability allows an attacker to disrupt the availability of the service.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
None
Integrity
None
Availability
Low
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.6% · higher than 51% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RB
RHEL-8 based Middleware Containers · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7.6 for RHEL 7 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7.6 for RHEL 8 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat Single Sign-On 7.6 for RHEL 9 · Red Hat
All versions, or not specified · source: vendor
RH
Red Hat build of Keycloak 26.4 · Red Hat
All versions, or not specified · source: vendor
BO
Build OF Keycloak · Redhat
26.4 before 26.4.10 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2026-2575
CVE.org
https://www.cve.org/CVERecord?id=CVE-2026-2575
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:3947
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:3948
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:76128
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:76129
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:76130
vendor-advisory
https://access.redhat.com/errata/RHSA-2026:76132
More from Red Hat build of Keycloak 26.4
9.8
CVE-2026-16442
Keycloak-services: keycloak-services: saml idp-initiated broker login bypasses link-only restriction
9.1
CVE-2026-18963
Keycloak-services: keycloak-services: unauthenticated account takeover via reset-credentials flow bypass
9.1
CVE-2026-16443
Keycloak-services: keycloak-services: saml broker metadata import disables response signature validation
8.8
CVE-2026-15572
Keycloak-services: keycloak-services: dcr protocol mapper type-swap policy bypass allows privilege escalation
8.8
CVE-2026-9704
Keycloak: keycloak: privilege escalation due to oversized subject_token jwt